search menu icon-carat-right cmu-wordmark

CERT Coordination Center


VERITAS Backup Exec uses hard-coded authentication credentials

Vulnerability Note VU#378957

Original Release Date: 2005-08-12 | Last Revised: 2007-01-12

Overview

The VERITAS Backup Exec Remote Agent uses hard-coded authentication credentials. An attacker with knowledge of these credentials could access arbitrary files on a vulnerable system.

Description

VERITAS Backup Exec Remote Agent is a data backup and recovery solution with support for over-the-network backup. The standard port for the Remote Agent is 10000/tcp. The VERITAS Backup Exec Remote Agent uses a hard-coded, encrypted root password. An attacker with knowledge of this password and access to the Remote Agent may be able to retrieve arbitrary files from a vulnerable system. For more information, please refer to SYM05-011.

Note according to public reports, this vulnerability is actively being exploited.

Impact

A remote attacker may be able to gain access to, and retrieve arbitrary files from a target system.

Solution

Apply a security update
Install the security updates, as recommended by the Symantec Security Response SYM05-011.

In addition, the following workarounds may mitigate this vulnerability.

Restrict access


You may wish to block access to the vulnerable software from outside your network perimeter, specifically by blocking access to the ports used by VERITAS Backup Exec Remote Agent (typically 10000/tcp). This will limit your exposure to attacks. However, blocking at the network perimeter would still allow attackers within the perimeter of your network to exploit the vulnerability. The use of host-based firewalls in addition to network-based firewalls can help restrict access to specific hosts within the network. It is important to understand your network's configuration and service requirements before deciding what changes are appropriate.

Change the default port for the backup service

Changing the backup service's default port from 10000/tcp may reduce the chances of exploitation. Instructions on how to change the default port for the backup service are available in VERITAS support document 255174.

Encrypt sensitive information

To prevent attackers from reading sensitive information, consider encrypting it on your file system.

Vendor Information

378957
Expand all

Symantec, Inc.

Notified:  August 12, 2005 Updated:  September 22, 2005

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please refer to http://securityresponse.symantec.com/avcenter/security/Content/2005.08.12b.html. In addition, Reports claiming the patches described in SYM05-011 do not adequately fix the VERITAS Remote Agent hard-coded credentials vulnerability are now believed to be incorrect.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Veritas Backup-Exec

Updated:  August 12, 2005

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

This vulnerability was reported by Symantec

This document was written by Jeff Gennari.

Other Information

CVE IDs: CVE-2005-2611
Severity Metric: 36.98
Date Public: 2005-08-12
Date First Published: 2005-08-12
Date Last Updated: 2007-01-12 21:42 UTC
Document Revision: 107

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.